Make jarvOS MCP rollback exact and gate CE by Codex version

[levineam]

Goal linkage

Make the public Codex adapter safe to stage without claiming ownership of an
existing MCP registration, and prevent managed Compound Engineering activation
on an unreviewed Codex CLI version.

Dogfood evidence

Read-only MacBook preflight found two confirmed blockers:

1. JARVOS_MANAGED_HARNESS_ROLLBACK=1 removed and then re-added the jarvos
   MCP registration.
2. The shipped Compound Engineering conformance receipt records Codex 0.146.0,
   while activation did not compare that evidence with the live CLI version.

The active Codex profile was not intentionally activated or modified and has no
jarvOS MCP, lifecycle hook, or Compound Engineering provider enabled.

Included scope

• Record a small owner-only receipt for only the jarvos MCP registration that
  setup creates.
• Preserve pre-existing, changed, or inconclusively inspected registrations.
• Make MCP rollback remove-only and clear the receipt only after confirmed
  absence.
• Require the live Codex CLI version to exactly match the validated conformance
  receipt before any managed Compound Engineering setup write; repeat the check
  immediately before provider activation.
• Prove the lifecycle in disposable CODEX_HOME fixtures and package the
  receipt helper.

Explicitly excluded

• Whole-profile transactional rollback.
• Hook trust or feature-setting restoration.
• Doctor/Runtime Kit compatibility schema changes.
• Stable-runtime publication policy.
• Installation into the active Codex profile.

Those remain separate activation gates. This issue alone does not authorize a
full-profile installation.

Definition of Done

• Rollback has no path that adds an MCP registration.
• No receipt plus a pre-existing jarvos registration preserves it and stops.
• A valid receipt authorizes removal only while the current normalized
  registration still matches it.
• Partial add, missing registration, removal failure, changed registration,
  invalid receipt, and inconclusive inspection outcomes are deterministic and
  covered by tests.
• Version mismatch stops before MCP, hook, feature, provider, or receipt writes;
  exact match permits the reviewed provider path; rollback is never version
  blocked.
• Focused suites, package verification, exact-commit independent review, and
  draft PR CI are green before any activation decision.

Communication contract

Keep the PR draft. Do not merge or activate from this issue alone; report the
remaining feature/trust and stable-publication gates separately.

[levineam]

Scope correction after independent review:

The first implementation draft expanded into a full Codex-config transaction
journal. That is disproportionate and will not be used. The bounded GH-254 fix
is now:

1. Add a small, owner-only MCP ownership record scoped to the selected
   CODEX_HOME.
2. Never add the jarvOS MCP during rollback; remove it only when its current
   normalized fingerprint matches the jarvOS-owned record.
3. Preserve/refuse a pre-existing or subsequently changed jarvOS MCP entry.
4. Recover an interrupted add when the entry is observable afterward.
5. Before any managed-provider write, require the live Codex version to match
   the version already recorded in the approved conformance receipt.

Feature-flag restoration, hook-trust restoration, a general setup transaction
journal, Doctor/schema expansion, and stable-runtime publication policy are
separate follow-ups. They are not part of GH-254.

[levineam]

Draft PR #255 is open at exact commit 7270b3b.

Verified locally:

• full npm test passes using the existing isolated Python test environment
• package dry run includes the MCP receipt helper
• Terra exact-commit review: no P0-P2 findings
• Sol/high exact-commit review: APPROVE, no P0-P2 findings

The implementation remains limited to exact MCP ownership/removal and the managed CE live-version gate. No active-profile installation is authorized. Hook/feature restoration, stable-runtime publication, and the Mac Mini audit remain separate gates.

One test-fixture isolation miss briefly created only a pending receipt in the active Codex home while using a fake CLI. It was immediately moved to recoverable quarantine; no live MCP registration, hooks, plugins, provider state, or config.toml content changed. The fixture now always uses a disposable CODEX_HOME and the previously omitted integration test is wired into npm test.